https://community.splunk.com/t5/Other-Usage/Application-Logs-Monitoring-in-Splunk/m-p/669964#M1624 <P>Hi All,</P><P>We have configured application log monitoring on windows application servers. The log path has a folder where all the _json files are stored. There are more that 300+ json files in each folder with different time stamps and dates. We have configured inputs.conf as shown below with ignoreOlderThan =2d so that Splunk should not consume more CPU/memory. But still we could see memory and CPU of the application server is going high. Kindly suggest best practice methods so that Splunk universal forwarder wont consume more CPU and memory.</P><P>&nbsp;</P><P><SPAN><SPAN class="">[monitor://C:\Logs\xyz\zbc\*]<BR />disabled = false<BR />index = preprod_logs<BR />interval =300<BR />ignoreOlderThan = 2d</SPAN></SPAN></P> Tue, 28 Nov 2023 06:02:59 GMT Manjunath_Splnk 2023-11-28T06:02:59Z https://community.splunk.com/t5/Other-Usage/Application-Logs-Monitoring-in-Splunk/m-p/669964#M1624 <P>Hi All,</P><P>We have configured application log monitoring on windows application servers. The log path has a folder where all the _json files are stored. There are more that 300+ json files in each folder with different time stamps and dates. We have configured inputs.conf as shown below with ignoreOlderThan =2d so that Splunk should not consume more CPU/memory. But still we could see memory and CPU of the application server is going high. Kindly suggest best practice methods so that Splunk universal forwarder wont consume more CPU and memory.</P><P>&nbsp;</P><P><SPAN><SPAN class="">[monitor://C:\Logs\xyz\zbc\*]<BR />disabled = false<BR />index = preprod_logs<BR />interval =300<BR />ignoreOlderThan = 2d</SPAN></SPAN></P> Tue, 28 Nov 2023 06:02:59 GMT https://community.splunk.com/t5/Other-Usage/Application-Logs-Monitoring-in-Splunk/m-p/669964#M1624 Manjunath_Splnk 2023-11-28T06:02:59Z